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© A method and system for providing safe patient 
monitoring in an electronic medical device while 
serving as a general-purpose windowed display is 
provided. In a preferred embodiment, an electronic 
medical device is capable of providing services to 
executing programs in response to requests for ser- 
vices from executing programs. These requests for 
£j! services each specify a service to be provided. The 
^ electronic medical device ensures the integrity of an 
^ executing patient monitoring program while simulta- 
jfr neously providing services to a non-patient monitor- 
ing program that is executing. The electronic medi- 
00 cal device provides the service specified by each 
J§ request for services from the executing patient moni- 
toring program and declines to provide services as 
O they are specified by requests for services from the 




executing non-patient monitoring program if provi- 
sion of the service as specified would interfere with 
the executing patient monitoring program. In one 
embodiment, the electronic medical device omits to 
provide any service in response to a request for 
services from the executing non-patient monitoring 
program that specifies a service that would interfere 
with the executing patient monitoring program. In 
one embodiment, the electronic medical device pro- 
vides a service specified by the executing non- 
patient monitoring program in a manner different 
from that specified in the request for services, where 
the service provided in the different manner does not 
interfere with the executing patient monitoring pro- 
gram. 
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Technical Field 

The invention relates generally to a method 
and system for presenting visual output in an elec- 
tronic medical device, and more specifically, to a 
method and system for providing safe patient mon- 
itoring while serving as a general-purpose win- 
dowed display. 

Background of the Invention 

Electronic medical devices such as electrocar- 
diogram (E.C.G.) monitors are generally used to 
monitor a patient's condition using medical sensors 
and/or to deliver medical care via automatic medi- 
cal care delivery systems. These devices have 
long been able to display information directly relat- 
ing to patient condition or medical care delivery in 
both graphical and textual forms. For example, a 
E.C.G. monitor might display an electrocardiograph 
waveform and associated text, e.g., pulse rate. This 
information, displayed together, is called a phys- 
iological parameter. 

These electronic medical devices have cus- 
tomarily employed custom hardware and software 
to achieve their results. The advent of general- 
purpose computing software, however, has made it 
expeditious to implement electronic medical de- 
vices using some general-purpose software. In fact, 
using general-purpose software permits the imple- 
mented electronic medical device to leverage exist- 
ing operating systems, graphical operating environ- 
ments, and application programs. The use of exist- 
ing operating systems and graphical environments 
makes the implemented electronic medical device 
more flexible by providing a ready-made develop- 
ment environment in which third-party vendors may 
develop add-on software products that can execute 
on the electronic medical device. 

In particular, it is desirable to permit third-party 
applications, such as a calculator application, to 
execute in a graphical operating environment, such 
as the public domain X-Window distributed operat- 
ing environment, along with the monitoring pro- 
grams that perform the primary monitoring function 
of the electronic medical device. This permits the 
third-party applications to display output in a win- 
dow on the display device and receive input from 
input devices connected to the electronic medical 
device. 

In many cases, however, third-party applica- 
tions can interfere with the primary monitoring 
function of the electronic medical device. Third- 
party applications can, in many cases, capture ail 
user input for extended periods of time, lockup the 
processor when a run-time error, change the color 
of monitoring display, or obscure or generally dis- 
rupt the display organization. Such interference 



with the primary monitoring function of th elec- 
tronic medical device is a matter of great concern, 
as it could cause important information from the 
electronic medical device to go unobserved by 

5 personnel monitoring the electronic medical device, 
adversely impacting patient care. 

First, in most windowed operating environ- 
ments, all the active applications are eligible to 
receive user input. User input in most windowed 

10 operating environments is directed to the applica- 
tion which has the input focus. Typically, the cursor 
is used to select the application window which is to 
have the input focus. In many window operating 
environments, however, a single application can 

75 "capture" the cursor and prevent the system and 
operator from changing the input focus. This per- 
mits third-party applications to deprive patient mon- 
itoring applications of user input for extended 
periods of time. This deprivation can significantly 

20 interfere with the primary monitoring functions of 
the electronic medical device such as acknowledg- 
ing alarm events, turning alarms off, or just gen- 
erally interacting with the electronic medical de- 
vice. 

25 In many windowing systems, capturing the cur- 

sor also causes the display contents to "freeze" 
until the cursor is "released." A typical example is 
scroll bars that update the display only alter a user 
has positioned the scroll bar and released the 

30 cursor. Under this circumstance, however, stale or 
incorrect patient information will be displayed while 
the electronic medical device's display is frozen. 

Second, in many windowed operating environ- 
ments, when a run-time error occurs during the 

35 execution of a request from a third-party applica- 
tion, "processor lockup" occurs. This is a condition 
of a processor which prevents it from completing 
the execution of the current request and proceed- 
ing to execute further requests. If a third-party 

40 application causes processor lockup to occur, re- 
quests from patient monitoring applications waiting 
for execution cannot be executed. This interferes 
with the primary monitoring function of the elec- 
tronic medical device by preventing the display of 

45 important patient monitoring information. 

Third, most windowed operating environments 
permit third-party applications to modify the colors 
used to display information. Most graphical operat- 
ing environments maintain a single color table to 

so map virtual colors, understood by applications, to 
actual color values that may be displayed on a 
display device. In order to be able to select the 
actual colors displayed, each application is permit- 
ted to change the contents of the color table. The 

55 number of colors required by ail the applications 
often exceeds the capacity of the color table. When 
this occurs, most windowed operating nviron- 
ments permit applications to maintain their own 
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virtual color map, which is loaded into the physical 
color map whenever that particular application has 
the input focus. This has the side effect of chang- 
ing the display colors for the entire display ad- 
versely affecting the rest of the applications. For 
instance, a third-party application could change the 
actual color of the monitoring applications informa- 
tion to the actual color of the background making 
the patient information invisible. This would also 
allow third party applications to change monitoring 
applications colors which have special significance, 
e.g., red for an alarm condition, to another color 
having a different significance, e.g., blue for a non- 
alarm, condition. In this example, an alarm con- 
dition could be displayed in blue instead of red, 
giving those monitoring the electronic medical de- 
vice the false impression that no alarm condition is 
active. 

Fourth, most modem windowing environments 
support overlapping windows in which windows are 
permitted to overlay some or all of the area of 
other windows. This permits a third-party applica- 
tion's window to overlay important information dis- 
played by the monitoring applications. For exam- 
ple, a user of a third-party application may drag the 
window containing output from the third-party ap- 
plication to a portion of the display occupied by 
important information such as alarm notification 
messages. At this point, the important information 
"displayed" by the monitoring programs is actually 
obscured by the applications window, and cannot 
be seen by those monitoring the electronic medical 
device. Important command windows or notifica- 
tions of alarm events needed by the user to begin 
monitoring new conditions or otherwise control the 
state of the electronic medical device can likewise 
be overlaid. 

Fifth, because users can rearrange the con- 
tents of the display as described above, the display 
may be left in completely different states. For ex- 
ample, windows for various third-party applications 
may be scattered about the display area. Portions 
of the information displayed by the monitoring pro- 
grams may be relocated and obscured, as may be 
command windows, This makes it confusing for a 
different user, or even the same user returning 
later, to locate important information or command 
windows. 

Because user interface reliability problems in 
electronic medical devices could compromise the 
health, or even life of the patients on which they 
are used, it is especially important that they be 
addressed in any system that supports the use of 
third-party applications in a windowed operating 
environment. 



Summary of the Invention 

The invention provides a method and system 
for providing safe patient monitoring in an el c- 
5 tronic medical device while serving as a general- 
purpose windowed display. In a preferred embodi- 
ment, an electronic medical device is capable of 
providing services to executing programs in re- 
sponse to requests for services from executing 
w programs. These requests for services each speci- 
fy a service to be provided. The electronic medical 
device ensures the integrity of an executing patient 
monitoring program while simultaneously providing 
services to an executing non-patient monitoring 
75 program. The electronic medical device provides 
the service specified by each request for services 
from the executing patient monitoring program and 
declines to provide services as they are specified 
by requests for services from the executing non- 
20 patient monitoring program if provision of the ser- 
vice as specified would interfere with the executing 
patient monitoring program. In one embodiment, 
the electronic medical device refuses to provide 
any service in response to a request for services 
25 from the executing non-patient monitoring program 
that specifics a service that would interfere with the 
executing patient monitoring program. In one em- 
bodiment, the electronic medical device provides a 
service specified by the executing non-patient 
30 monitoring program in a manner different from that 
specified in the request for services, where the 
service provided in the different manner does not 
interfere with the executing patient monitoring pro- 
gram. 

35 

Brief Description of the Drawing 

Figure 1 is a high-level block diagram of the 
electronic medical device in which a preferred em- 
40 bodiment of the invention operates. 

Figures 2A-2B are display images showing an 
example of protected regions enforcement. 

Figures 3A-3B are screen images showing the 
operation of the normal screen command window. 

45 

Detailed Description of the Invention 
L Overview 

50 The inventive method and system provides 

safe patient monitoring in an electronic medical 
device while serving as a general-purpose win- 
dowed display. In a preferred embodiment, system 
services are provided in the electronic medical 

55 device that protect the integrity of the primary 
monitoring function of the electronic medical device 
from interference caused by third-party application 
programs (third-party applications). These system 
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services, along with specialized hardware, int r- 
vene to prevent extended user input capture detect 
and correct run-time processor lockup, provide 
separate color tables for monitoring programs and 
third-party applications, enforce protected regions 
within the display area into which output from the 
third-party applications cannot be moved, provide a 
command that is always available to users for 
returning the display area to a standard organiza- 
tion, optionally restrict the number of visible third- 
party applications, and iconify large third-party ap- 
plication windows when a monitoring alarm con- 
dition occurs. In a preferred embodiment, the sys- 
tem services described are provided by modifying 
aspects of the standard version of X-Windows, a 
public domain distributed operating environment 
and by fabricating specialized hardware for execut- 
ing the operating environment and other programs. 

Figure 1 is a high-level block diagram of the 
electronic medical device in which a preferred em- 
bodiment of the invention operates. The electronic 
medical device 100 contains a patient monitoring 
subsystem (monitoring subsystem) 110 for collect- 
ing and analyzing patient data and a graphics sub- 
system 120 for displaying output and receiving 
user input for both patient monitoring applications 
and non-patient monitoring applications. The elec- 
tronic medical device also includes shared memory 
130 that may be accessed by both the monitoring 
subsystem and the graphics subsystem. The elec- 
tronic medical device further includes a network 
connection 140 that may be used by both the 
monitoring subsystem and the graphics subsystem 
to communicate with other computer systems con- 
nected to the electronic medical device by a net- 
work. The monitoring subsystem contains dedi- 
cated monitoring memory (monitoring memory) 
111, a monitoring central processing unit (monitor- 
ing CPU) 112 and medical sensors 113-115, such 
as E.C.G. electrodes or pulse oximetry sensors, to 
monitor patients. Patient data from the medical 
sensors is stored in the monitoring memory and 
analyzed by the monitoring CPU. The monitoring 
CPU requests display services from the graphics 
subsystem in order to display the results of patient 
data analysis. The graphics subsystem supports 
user input/output devices 123 with which to display 
information, including messages, to users and ac- 
cept input from them. Among the user input/output 
devices is a display device 124 comprising a video 
monitor 125, for displaying information, and a dis- 
play interface 126 for controlling and transmitting 
information to the video monitor. The user in- 
put/output devices further include a keyboard 127 
and a pointing device 128, such as a mouse The 
programs required to provide the system services 
of the preferred embodiment, as well as monitoring 
programs and third-party applications, reside in the 



graphics memory. The graphics memory is prefer- 
ably a solid-state memory device whose contents 
may be permanent or may be loaded from, a local 
disk drive or a remote disk drive controlled by a 

5 separate computer system to which the electronic 
medical device 100 is connected via the network 
connection. The above programs execute on a 
graphics CPU 122, or on the CPU of a separate 
computer system to which the electronic medical 

10 device 100 is connected via the network connec- 
tion. 

II. Prevent Extended User Input Capture 

75 When a third-party application captures the 

cursor, all subsequent user input is directed to the 
capturing third-party application. While this is nec- 
essary in some situations, e.g., to cause a scroll 
bar in the third-party application's window to func- 

20 tion properly, the longer the capture continues, the 
longer the patient monitoring programs are de- 
prived of any user input and the display contents 
are frozen. Since this can prevent users from per- 
forming necessary interaction with patient monitor- 

25 ing programs and cause stale or incorrect informa- 
tion to be displayed, the electronic medical device 
limits the amount of time for which any third-party 
application can capture the focus. The electronic 
medical device preferably starts a countdown each 

30 time a third-party application captures the cursor. If 
a preselected period of time elapses before the 
capturing third-party application releases the cur- 
sor, the electronic medical device forces the cap- 
turing third-party application to release the cursor 

35 allowing the display to be refreshed and the input 
focus changed. 

III. Detect and Correct Run-Time Processor Lockup 

40 Run-time errors encountered by the electronic 

medical device's graphics processor while execut- 
ing a request for a third-party application can cause 
the lockup of the graphics processor. This is a 
condition of a processor that prevents it from com- 

45 pleting the execution of the current request and 
proceeding to execute further requests. To detect 
and correct run-time processor lockup, a graphics 
processor lockup watchdog is preferably included 
in the electronic medical device, The graphics pro- 

50 cessor lockup watchdog (watchdog) is a hardware- 
implemented countdown timer that counts down 
from a preselected interval and, when the interval 
expires, concludes that graphics processor lockup 
has occurred and attempts to correct it. The graph- 

55 ics processor, when it is operating normally, re- 
peatedly refreshes the watchdog before enough 
time elapses for the interval to expire, restarting the 
interval. When the graphics processor encounters a 
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run-time error causing a loadup, the graphics pro- 
cessor is unable to refresh the watchdog. The 
interval then expires, and the watchdog blanks the 
display area to prevent the display of old or in- 
correct information stored in display memory. The 
watchdog then signals the monitoring processor to 
attempt to correct the graphics processor lockup 
by raising a monitoring processor interrupt. The 
monitoring processor, in response to the interrupt, 
attempts to correct the graphics processor lockup 
by first canceling the request that the graphics 
processor is currently executing, If this fails, the 
monitoring processor attempts to correct the graph- 
ics processor lockup by resetting the graphics pro- 
cessor. If this fails, the monitoring processor at- 
tempts to correct the graphics processor lockup by 
warmstarting the electronic medical device, clear- 
ing the contents of graphics subsystem memory 
and shared memory, but maintaining the contents 
of monitoring subsystem memory which contains 
patient information. 

IV. Provide Separate Color Tables 

Generally, all applications display information 
on the display device by selecting a real color 
value (typically 24 bits) in which the information 
should be displayed, storing a mapping in a central 
color mapping table that maps to the selected real 
color value from some virtual color value small 
enough to fit in the storage allocated for each pixel 
in display memory (typically 8 bits), and using 
drawing routines to change the value of the display 
memory locations corresponding to the desired pix- 
els to the virtual color value used in the mapping. 
When the display interface periodically refreshes 
the displayed contents of the video monitor, it 
reads the virtual colors from display memory, maps 
them to real color values using the mapping table, 
transforms the digital real color value into an ana- 
log real color signal using one or more digital-to- 
analog converters, and refreshes the video monitor 
with the analog signal. 

When a third-party application has the focus, it 
can change mappings stored in the color mapping 
table. Any mappings stored earlier by the monitor- 
ing programs in the color mapping table would 
therefore usually be subject to undesirable modi- 
fication by third-party applications In order to pre- 
vent this, one or more additional color mapping 
tables are allocated within the display interface and 
an attribute portion containing one or more map- 
ping table selection bits is preferably added to the 
data portion of each pixel in display memory. The 
mapping table selection bits are used by the dis- 
play interface to determine which color table to use 
to display a given pixel. The Window Manager, 
which is responsible for initializing pixels to display 



newly opened windows, is preferably modified to 
also initialize the color table mapping bits. When a 
third-party application opens a window, the Window 
Manager sets the color table mapping bits for each 

5 pixel in the window to designate a default color 
mapping table. This is the color mapping table that 
is modified when the standard X-Windows service 
for modifying the color mapping table is invoked. 
The other color mapping tables are reserved for 

w use by the monitoring applications. When a moni- 
toring program opens a window, the Window Man- 
ager sets the color table mapping bits for each 
pixel in the window to designate one of the addi- 
tional color mapping tables. Because the monitor- 

15 ing programs are aware of the additional color 
mapping tables, they are able to invoke a special 
service, unknown to third-party applications, to 
modify the additional coior mapping tables. When 
the display interface sees the color table selection 

20 bits that designate one of the additional color map- 
ping tables when displaying pixels displayed by a 
monitoring program, it uses the appropriate color 
mapping table to map the virtual color value to an 
actual color value. Because the monitoring pro- 

25 grams are unaware of the additional color mapping 
tables, they cannot modify the mappings stored 
therein by monitoring programs, and may therefore 
not alter the actual colors in which the monitoring 
programs display information. 

30 In a preferred embodiment, two phantom mem- 

ory regions are created in memory that both re- 
solve to the actual display memory. The first of 
these phantom memory ranges is supplied to pro- 
grams for passing to drawing routines called to 

35 display information. This range maps to the data 
portion of each pixel in display memory, where the 
virtual color value is stored. When programs use 
drawing routines to modify the first phantom mem- 
ory region, they modify only the data portions of 

40 display memory containing only virtual color val- 
ues, and do not affect the attribute portions of 
display memory containing color map selection 
bits. The second of these phantom memory ranges 
is used to set attributes for each pixel stored in the 

45 attribute portions of the representation of each pixel 
in display memory. Attributes include color map- 
ping table selection bits, as well as other data 
required to administer the display for monitoring 
programs. This other data includes indications of 

5b whether the pixel will be used to display patient 
physiological parameters or real-time video, each 
using custom drawing facilities instead of the stan- 
dard X-Windows drawing routines. The other data 
also includes indications of whether the other bits 

55 of the attribute portion and all of the bits of the data 
portion together contain a truncated real color val- 
ue, called a true color value, to be display d by the 
display interface without color mapping. The sec- 



6 



9 



EP 0 668 047 A2 



10 



ond phantom range is used by the modified win- 
dow manager to quickly initialize or change the 
attributes for a group of pixels without changing the 
virtual color value of any of pixels in the group. 

V. Enforce Protected Regions 

In the preferred embodiment, protected regions 
include critical patient information such as high 
priority physiological parameters and a patient sta- 
tus area used to notify the operator of local alarm 
events. Command windows are also protected. The 
command windows are made up of menu keys that 
are used by the operator to invoke commands that 
modify the state of the electronic medical device 
such as acknowledging alarm events. The window 
manager monitors window open and movement 
requests made by the applications to the X-Win- 
dow X-Server. When the Window Manager ob- 
serves a request from an application window to 
overlap a protected region, the Window Manager 
submits a request to the X-Server to move the 
window to a new, nearby location outside of all the 
protected zones. This prevents any application 
from overlapping the contents of a protected re- 
gion. 

Figures 2A-2B are display images showing an 
example of protected regions enforcement. The 
display area 200 contains protected regions 201, 
containing important patient parameters 202 and 
203; 204, containing hard keys 205-209; and 210, 
containing soft keys 211-215 and patient status 
area 216. A user uses a pointing device to move 
the window for a third-party calculator program 221 
in its present location to a target location shown in 
Figure 2A by a broken-line box 222. The target 
location overlays a protected region 201 encom- 
passing important patient parameters 202 and 203. 
The third-party application program submits a re- 
quest to the X-Server to move the window to the 
new location. The Window Manager observes the 
request, determines that the target location is with- 
in a protected region, and submits an instruction to 
the X-Server to move the window to location 221, 
outside of all of the protected regions as shown in 
Figure 2B. 

An application may request that the Window 
Manager display its output window in a full-screen 
mode. In this mode, the entire display is used to 
display the requesting application's window. In a 
preferred embodiment, the electronic medical de- 
vice relaxes protected region enforcement when an 
application requests the full-screen display of its 
window to permit the satisfaction of the request. 
That is, the electronic medical device satisfies full- 
screen requests, even though they encroach on all 
of the protected regions. In order to ensure that the 
satisfaction of a request for full-screen mode does 



not obscure alarm condition messages, the Win- 
dow Manager is preferably modified to iconify any 
full-screen window as soon as the electronic medi- 
cal device encounters an alarm condition. This 

5 permits the electronic medical device to display the 
alarm condition message without it being obscured 
by the full-screen window. The Window Manager is 
further preferably able to iconify any window larger 
than a configurable threshold area when the elec- 

io tronic medical device encounters an alarm con- 
dition, making it less likely that alarm condition 
messages will be obscured by any display window. 

VI. Provide Command For Returning The Display 
75 Area To A Standard Organization 

A "normal screen" command for returning the 
display area to a standard organization is prefer- 
ably always available to the user. A command 

20 window, preferably a hard key as described above, 
is displayed in a protected region, permitting the 
user to invoke the normal screen command at any 
time. The command window may be invoked by a 
user when the contents of the display area have 

25 become rearranged and confusing to return the 
display area to a familiar organization in which 
important information can be readily located. 

Figures 3A-3B are screen images showing the 
operation of the normal screen command window. 

30 Figure 3A shows the contents of the display area 
300 in a relatively confusing state. The display area 
contains hard keys 301-306, including "normal 
screen" hard key 306, soft: keys 311-315. High 
priority patient parameters 321 and 322 are com- 

35 pletely visible, but other patient parameters are not: 
patient parameters 323 is partially obscured by a 
calendar application window 341, and patient pa- 
rameter 324 is completely obscured by a calculator 
application window 342. An alarm watch window 

40 331 is also partially obscured by a calendar ap- 
plication window 341 , In order to return the display 
area to a familiar organization in which important 
information can be readily located, the user uses 
the pointing device to activate the normal screen 

45 hard key. 

In response to the activation of the normal 
screen hard key, the electronic medical device 
returns the display to a standard organization. The 
electronic medical device "iconifies" any applica- 

50 tion programs, or closes their windows and dis- 
plays small icons in their place. This leaves only 
patient and alarm watch windows visible. The user 
may restore the window for any iconified applica- 
tion in its original location by using the pointing 

55 device to select its icon. This is shown in Figure 
3B. The calendar application window 341 and cal- 
culator application window 342 have been iconified, 
replaced with calendar icon 347 and calculator icon 
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346, respectively. This has the effect of making 
patient parameters 323 and 324, as well as alarm 
watch window 331 , completely visible. 

VII. Optionally Restrict The Number Of Visible 
Third-Party Applications 

The user is permitted to specify a special 
display mode in which only a predetermined maxi- 
mum number of third-party application are visible 
at a given time. In view of the low tolerance of 
beginner users for display complexity, the maxi- 
mum number is preferably one. This restriction is 
implemented by modifying the Window Manager to 
keep track of the number of third-party applications 
that have open windows. If the Window Manager 
receives a request from a third-party application to 
open a new window, and if the user has specified 
the special display mode, and if the number of 
third-party applications that have open windows is 
equal to the maximum number of third-party ap- 
plications, then the Window Manager selects a 
third-party application having an open window to 
iconify. The Window Manager preferably selects 
the third-party application with an open window that 
has the lowest priority. The Window Manager then 
iconifies the selected third-party application so that 
its window is no longer displayed and continues to 
open a new window in response to the request. 
This limits the extent to which important monitoring 
information can be obscured from the user. 

VIII. Conclusion 

While this invention has been shown and de- 
scribed with reference to preferred embodiments, it 
will be understood by those skilled in the art that 
various changes or modifications in form and detail 
may be made without departing from the scope of 
the invention. For example, virtually each aspect of 
the invention could be implemented either in soft- 
ware or hardware design. 

Claims 

1. In an electronic medical device capable of 
providing services to executing programs in 
response to requests for services from execut- 
ing programs, the requests for services speci- 
fying a service to be provided, a method for 
ensuring the integrity of an executing patient 
monitoring program while simultaneously pro- 
viding services to an executing non-patient 
monitoring program, the method comprising 
the steps of: 

executing the patient monitoring program; 

providing the service specified by each 
request for services from the executing patient 



monitoring program; 

executing the non-patient monitoring pro- 
gram; and 

declining to provide servic s as specified 
5 by requests for services from the executing 

non-patient monitoring program if provision of 
the service as specified would interfere with 
the executing patient monitoring program. 

io 2. The method of claim 1 wherein the step of 
declining to provide services is accomplished 
by omitting to provide any service in response 
to a request for services from the executing 
non-patient monitoring program that specifies a 

75 service that would interfere with the executing 

patient monitoring program. 

3. The method of claim 2 wherein the electronic 
medical device has a display device having a 

20 display area, and wherein at least a portion of 

the requests for services from executing pro- 
grams specify a display service for displaying 
specified output within the display area, and 
wherein the providing step is accomplished by 

25 displaying the output specified by the request 

in a location within the display area that is 
substantially the same as the location specified 
by the request, and wherein the step of omit- 
ting to provide any service that would interfere 

30 with the executing patient monitoring program 

by omitting to display the output specified by 
the request if the display of the output speci- 
fied by the request would interfere with the 
display of output by the executing patient mon- 

35 itoring program. 

4. The method of claim 2 wherein the electronic 
medical device maintains a patient monitoring 
program color mapping table for mapping vir- 

40 tual color values used by the executing patient 

monitoring program to real color values, and 
wherein at least a portion of the requests for 
services from executing programs specify, a 
patient monitoring program color mapping ta- 

45 ble alteration service for altering the real color 

value to which a specified virtual color value 
used by the executing patient monitoring pro- 
gram maps in the patient monitoring program 
color mapping table, and wherein the providing 

50 step responds to requests specifying the pa- 

tient monitoring program color mapping table 
alteration service from the executing patient 
monitoring program by altering the real color 
value to which a specified virtual color value 

55 used by the executing patient monitoring pro- 

gram maps in the patient monitoring program 
color mapping table, and wherein the step of 
omitting to provide any service that would in- 
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terfere with the executing patient monitoring 
program is accomplished by responding to re- 
quests specifying the patient monitoring pro- 
gram color mapping table alteration service 
from the executing non-patient monitoring pro- 5 
gram by omitting to alter the real color value to 
which the specified virtual color value used by 
the executing patient monitoring program 
maps in the patient monitoring program color 
mapping table. n* 

The method of claim 1 wherein requests for 
services from executing programs further 
specify a manner in which the services to be 
provided, and wherein the step of declining to is 
provide services is accomplished by adaptively 
providing a service specified by the executing 
non-patient monitoring program in a manner 
different from that specified in the request for 
services that does not interfere with the ex- 20 
ecuting patient monitoring program. 

The method of claim 5 wherein the electronic 
medical device has a display device having a 
display area, and wherein at least a portion of 25 
the requests for services from executing pro- 
grams specify a display service for displaying 
specified output at a specified location within 
the display area, and wherein the providing 
step is accomplished by displaying the output 30 
specified by the request in a location within the 
display area that is substantially the same as 
the location specified by the request, and 
wherein the adaptively providing step is ac- 
complished by displaying the output specified 35 
by the request in a location within the display 
area that is as close to the location specified 
by the request as is possible without interfer- 
ing with the display of output by the executing 
patient monitoring program. 40 

The method of claim 5 wherein the electronic 
medical device maintains a patient monitoring 
program color mapping table for mapping vir- 
tual color values used by the executing patient 45 
monitoring program to real color values, and 
wherein at least a portion of the requests for 
services from executing programs specify a 
patient monitoring program color mapping ta- 
ble alteration service for altering the real color so 
value to which a specified virtual color value 
used by the executing patient monitoring pro- 
gram maps in the patient monitoring program 
color mapping table, and wherein the elec- 
tronic medical device also maintains a non- 55 
patient monitoring program color table for 
mapping virtual color values used by the ex- 
ecuting non-patient monitoring program to real 



color values, and wherein the providing step 
responds to requests specifying the patient 
monitoring program color mapping table alter- 
ation service from the executing patient moni- 
toring program by altering the real color value 
to which a specified virtual color value used by 
the executing patient monitoring program 
maps in the patient monitoring program color 
mapping table, and wherein the adaptively pro- 
viding step is accomplished by responding to 
requests specifying the patient monitoring pro- 
gram color mapping table alteration service 
from the executing non-patient monitoring pro- 
gram by altering the real color value to which a 
specified virtual color value used by the ex- 
ecuting non-patient monitoring program maps 
in the non-patient monitoring program color 
mapping table, 

8. The method of claim 5 wherein at least a 
portion of the requests for services from ex- 
ecuting programs specify a user input capture 
service for capturing substantially all of the 
input provided by a user, and wherein requests 
for services that specify the user input capture 
service also specify a user input capture dura- 
tion, and wherein the providing step is accom- 
plished by providing the user input capture 
service for the specified user input capture 
duration, and wherein the adaptively providing 
step is accomplished by providing the user 
input capture service for a duration not ex- 
ceeding a predetermined maximum duration. 

9. The method of claim 5 wherein the adaptively 
providing step is accomplished by the steps 
of: 

providing the service specified by the ex- 
ecuting non-patient monitoring program; 

detecting a run-time error during the provi- 
sion of the service; and 

upon detecting the run-time error, ceasing 
to provide the service specified by the execut- 
ing non-patient monitoring program. 

10. The method of claim 9 wherein the ceasing to 
provide step is accomplished by resetting the 
electronic medical device. 

11. The method of claim 5 wherein at least a 
portion of the requests for services from ex- 
ecuting programs specify a window display 
service for displaying a window containing out- 
put from the requesting application, the dis- 
played window having an area, and wherein 
the adaptively providing step is accomplished 
by the steps of: 

providing the window display service 
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specified by the executing non-patient monitor- 
ing program; 

detecting an alarm condition; and 
upon detecting the alarm condition, if the 
window displayed by the provision of the win- 
dow display service has an area greater than a 
threshold area, reducing the area of the dis- 
played window. 

12. The method of claim 11 wherein the step of 
reducing the area of the displayed window 
includes the step of iconifying the displayed 
window. 

13. In an electronic medical device having a micro- 
processor, a display device, and a input de- 
vice, the display device having a display area, 
a method for ensuring the integrity of the dis- 
play of the output of patient monitoring pro- 
grams while simultaneously displaying the out- 
put of additional executing programs, the addi- 
tional programs being capable of capturing in- 
put from the input device, the method compris- 
ing the steps of: 

limiting the duration of input capture by 
any of the additional programs; 

using separate display color mapping ta- 
bles to display the output of the patient moni- 
toring programs and the output of the addi- 
tional programs; 

preventing the display of the output of the 
additional programs in predefined protected re- 
gions within the display area; and 

in response to receiving a normal screen 
command, redisplaying the contents of the dis- 
play area in a preselected standard organiza- 
tion. 

14. The method of claim 13, further including the 
steps of: 

detecting a run-time error while displaying 
the output of an executing program; and 
clearing the detected run-time error. 

15. The method of claim 13, further including the 
step of limiting the number of additional pro- 
grams that may display information in the dis- 
play area to a predetermined maximum num- 
ber of additional programs. 

16. The method of claim 15 wherein the limiting 
step includes the steps of; 

in response to a request to display the 
output of one of the additional programs, com- 
paring the number of the additional programs 
presently executing to the predetermined 
maximum number of the additional programs; 

approving the request to display the output 



of one of the additional programs; and 

if the number of the additional programs 
presently executing is not less than the pre- 
determined maximum number of additional 
5 programs, iconifying the output displayed in 

accordance with an earlier-approved request to 
display the output of one of the additional 
programs. 

io 17. The method of claim 13 wherein the display 
area is comprised of pixels, each of the pixels 
being periodically refreshed with a real color 
value, and wherein the step of using separate 
display color mapping tables to display the 

75 output of the patient monitoring programs and 

the output of the additional programs includes 
the steps of: 

when a pixel in the display area is to be 
refreshed, reading an attribute portion of a 

20 pixel representation corresponding to the pixel 

that is to be refreshed; 

selecting one of a plurality of available 
color mapping tables based upon the read 
attribute portion of a virtual color value, each of 

26 the available color mapping tables mapping a 

virtual color value to a real color value; 

reading a virtual color value portion of the 
pixel representation containing a virtual color 
value; 

30 using the selected color mapping table to 

map the virtual color value of the read virtual 
color virtual color value portion of the pixel 
representation to a real color value; and 

refreshing the pixel using the real color 

35 value. 

18. The method of claim 13 wherein the step of 
preventing the display of the output of the 
additional programs in predefined protected re- 
40 gions within the display area includes the 

steps of; 

receiving a display request to display 
specified output of one of the additional pro- 
grams in a specified target region within the 
45 display; 

determining whether the specified target 
region of the received request intersects a 
protected region; 

if the specified target region of the re- 
50 ceived request intersects a protected region: 

identifying an alternate target region within 
the display that is near the specified target 
region and that does not intersect any pro- 
tected region, and 
55 causing the specified output to be dis- 

played in the alternate target region; and 

if the specified target region of the re- 
ceived request intersects no protected regions, 
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causing the specified output to be displayed in 
the specified target region. 

19. In an electronic medical device having both a 
microprocessor and a display device, the dis- 
play device having a display area, a method 
for ensuring the integrity of the display of the 
output of patient monitoring programs while 
simultaneously displaying the output of addi- 
tional executing programs by limiting the num- 
ber of the additional programs that may dis- 
play information in the display area to a pre- 
determined maximum number of additional 
programs, the method comprising the steps of: 

in response to a request to display the 
output of one of the additional programs, com- 
paring the number of the additional programs 
presently executing to the predetermined 
maximum number of additional programs; 

approving the request to display the output 
of one of the additional programs; and 

if the number of the additional programs 
presently executing is not less than the pre- 
determined maximum number of additional 
programs, iconifying the output displayed in 
accordance with an earlier-approved request to 
display the output of one of the additional 
programs. 

20. In an electronic medical device upon which 
programs may execute, the display device 
having a display area, the display device hav- 
ing a display area, the electronic medical de- 
vice having a display device, a method for 
ensuring the integrity of the display of the 
output of patient monitoring programs while 
simultaneously displaying the output of addi- 
tional executing programs by inhibiting monop- 
olization of the processor by any of the addi- 
tional programs, the method comprising the 
steps of: 

detecting a run-time error during the ex- 
ecution of an additional program; and 
clearing the detected run-time error. 

21. In an electronic medical device upon which 
programs may execute, the electronic medical 
device having a display device, the display 
device having a display area, a method for 
ensuring the integrity of the display of the 
output of patient monitoring programs while 
simultaneously displaying the output of addi- 
tional executing programs by limiting the cap- 
ture of user input by any additional program, 
the method comprising the steps of: 

monitoring for the capture of user input by 
an additional program; and 

if the duration of the monitored capture of 



user input exceeds a predetermined limit, forc- 
ing the additional program to release user in- 
put. 

5 22. In an electronic medical device upon which 
programs may execute, the electronic medical 
device having a display device, the display 
device having a display area, the display de- 
vice having a display area, a method for ensur- 

10 ing the integrity of the display of the output of 

patient monitoring program while simulta- 
neously displaying the output of additional ex- 
ecuting programs by using separate display 
color mapping tables to display the output of 

75 the patient monitoring programs and the output 

of the additional programs, the method com- 
prising the steps of; 

when a pixel in the display area is to be 
refreshed, reading an attribute portion of a 

20 pixel representation corresponding to the pixel 

that is to be refreshed; 

selecting one of a plurality of available 
color mapping tables based upon the read 
attribute portion of a virtual color value, each of 

25 the available color mapping tables mapping a 

virtual color value to a real color value; 

reading a virtual color value portion of the 
pixel representation containing a virtual color 
value; 

30 using the selected color mapping table to 

map the virtual color value of the read virtual 
color virtual color value portion of the pixel 
representation to a real color value; and 

refreshing the pixel using the real color 

35 value. 

23. In an electronic medical device upon which 
programs may execute, the display device 
having a display area, a method for ensuring 
40 the integrity of the display of the output of 

patient monitoring programs while simulta- 
neously displaying the output of additional ex- 
ecuting programs by preventing the display of 
the output of the additional programs in 
45 predefined protected regions within the display 

area, the method comprising the steps of: 

receiving a display request to display 
specified output of one of the additional pro- 
grams in a specified target region within the 
50 display; 

determining whether the specified target 
region of the received request intersects a 
protected region; 

if the specified target region of the re- 
55 ceived request intersects a protected region: 

identifying an alternate target region within 
the display that is near the specified target 
region and that does not intersect any pro- 
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vice in response to the display of an alarm 
condition message on the display device in 
order to ensure the visibility of the alarm con- 
dition message. 

5 

29. An electronic medical device capable of dis- 
playing output for both patient monitoring pro- 
grams and additional programs, the electronic 
medical device comprising: 
io a display device having a display area in 

which output for both patient monitoring pro- 
grams and additional programs is displayed; 

a network connection for connecting via a 
network to a remote computer system for stor- 
75 ing and executing the patient monitoring pro- 

grams and the additional programs; 

a display interface for displaying visual 
output in the display area of the display device 
that uses separate display color mapping ta- 
20 bles to display the output of the patient moni- 

toring programs and the output of the addi- 
tional programs; 

a processor regulator for inhibiting the mo- 
nopolization of program execution resources of 
25 the remote computer system by any of the 

additional programs; 

a display regulator for preventing the dis- 
play of the output of the additional programs in 
predefined protected regions within the display 
30 area; and 

a screen reorganizer for redisplaying the 
contents of the display area in a preselected 
standard organization in response to receiving 
a normal screen command. 

35 



tected region, and 

causing the specified output to be dis- 
played in the alternate target region; and 

if the specified target region of the re- 
ceived request intersects no protected regions, 
causing the specified output to be displayed in 
the specified target region. 

24. An electronic medical device capable of ex- 
ecuting and displaying output for both patient 
monitoring programs and additional programs, 
the electronic medical device comprising: 

a display device having a display area in 
which output for both patient monitoring pro- 
grams and additional programs is displayed; 

a memory for storing the patient monitor- 
ing programs and the additional programs; 

a processor for executing the patient moni- 
toring programs and the additional programs; 

a display interface for displaying visual 
output in the display area of the display device 
that uses separate display color mapping ta- 
bles to display the output of the patient moni- 
toring programs and the output of the addi- 
tional programs; 

a display regulator for preventing the dis- 
play of the output of the additional programs in 
predefined protected regions within the display 
area; and 

a screen reorganizer for redisplaying the 
contents of the display area in a preselected 
standard organization in response to receiving 
a normal screen command. 

25. The electronic medical device of claim 24, 
further including: 

an input device from which input is re- 
ceived; and 

an input capture limiter for limiting the 
duration of any capture of input from the input 40 
device by an additional program. 

26. The electronic medical device of claim 24, 
further including a processor watchdog for de- 
tecting and correcting the lockup of the pro- 45 
cessor. 

27. The electronic medical device of claim 24 
wherein the display regulator includes an addi- 
tional program display limiter for limiting the 50 
number of additional programs that may si- 
multaneously display output within the display 
area. 

28. The electronic medical device of claim 24, 55 
wherein the display regulator includes an alarm 
condition message protector for reducing the 

size of windows displayed on the display de- 



30. An electronic medical device capable of pro- 
viding services to executing programs in re- 
sponse to requests for services from executing 
programs, the requests specifying a service to 
be provided, the electronic medical device fur- 
ther capable of ensuring the integrity of a 
patient monitoring program while simulta- 
neously providing services to a non-patient 
monitoring program that is executing, the elec- 
tronic medical device comprising: 

a processor for executing the patient moni- 
toring program and the non-patient monitoring 
program; and 

a service regulator for: 

providing the service specified by each 
request for services from the executing patient 
monitoring program, and 

declining to provide any services specified 
by requests for services from the executing 
non-patient monitoring program that would in- 
terfere with the execution of the executing pa- 
tient monitoring program. 
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31. The electronic medical device of claim 30 
wherein the service regulator includes a ser- 
vice inhibitor that declines to provide any ser- 
vices that would interfere with the execution of 

the executing patient monitoring program by 5 
not providing any service in response to a 
request for services from the executing non- 
patient monitoring program that specifies a 
service that would interfere with the executing 
patient monitoring program. io 

32. The electronic medical device of claim 30 
wherein the requests for services further speci- 
fy a manner in which the service is to be 
provided, and wherein the service regulator 75 
includes a service modifier that declines to 
provide any services that would interfere with 

the execution of the executing patient monitor- 
ing program by performing a service specified 
by the executing non-patient monitoring pro- 20 
gram in a manner different from that specified 
in the request for services that does not inter- 
fere with the executing patient monitoring pro- 
gram. 
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